#!/bin/bash
set -e

# 检查 root 权限
if [[ $EUID -ne 0 ]]; then
   echo "请使用 root 用户执行此脚本."
   exit 1
fi

OPENSSL_MIRROR="https://mirrors.cloud.tencent.com/openssl/source/"
OPENSSH_MIRROR="https://mirrors.cloud.tencent.com/OpenBSD/OpenSSH/portable/"

# 步骤 1: 更换 USTC 镜像源
echo "备份原有的 sources.list..."
cp /etc/apt/sources.list /etc/apt/sources.list.bak.$(date +%F-%T)

echo "更换为 USTC 镜像源..."
cat > /etc/apt/sources.list <<EOF
deb https://mirrors.ustc.edu.cn/debian bookworm main contrib non-free non-free-firmware
deb-src https://mirrors.ustc.edu.cn/debian bookworm main contrib non-free non-free-firmware

deb https://mirrors.ustc.edu.cn/debian-security bookworm-security main contrib non-free non-free-firmware
deb-src https://mirrors.ustc.edu.cn/debian-security bookworm-security main contrib non-free non-free-firmware

deb https://mirrors.ustc.edu.cn/debian bookworm-updates main contrib non-free non-free-firmware
deb-src https://mirrors.ustc.edu.cn/debian bookworm-updates main contrib non-free non-free-firmware
EOF

echo "更新软件包索引..."
apt update

# 步骤 2: 系统补丁升级到最新版
echo "正在升级所有系统补丁到最新版本..."
apt upgrade -y
apt full-upgrade -y
apt --fix-broken install -y
apt autoremove -y
apt clean

# 步骤 3: 安装编译依赖
echo "安装编译依赖包..."
apt install -y build-essential zlib1g-dev libssl-dev libpam0g-dev libselinux1-dev wget curl

# 步骤 4: 下载并编译 OpenSSL 最新版本
echo "获取 OpenSSL 最新版本..."
OPENSSL_VERSION=$(curl -s $OPENSSL_MIRROR | grep -oP 'openssl-\d+\.\d+\.\d+[a-z]*\.tar\.gz' | sort -V | tail -1)
echo "最新 OpenSSL 版本: $OPENSSL_VERSION"

wget -c "${OPENSSL_MIRROR}${OPENSSL_VERSION}"
tar zxf $OPENSSL_VERSION
OPENSSL_SRC_DIR=$(tar -tf $OPENSSL_VERSION | head -1 | cut -d/ -f1)
cd "$OPENSSL_SRC_DIR"
echo "编译安装 OpenSSL..."
./config --prefix=/usr/local/openssl --openssldir=/usr/local/openssl shared zlib
make -j$(nproc)
make install
cd ..

echo "/usr/local/openssl/lib" > /etc/ld.so.conf.d/openssl.conf
ldconfig
export PATH="/usr/local/openssl/bin:$PATH"
echo 'export PATH="/usr/local/openssl/bin:$PATH"' >> /etc/profile

# 步骤 5: 下载并编译 OpenSSH 最新版本
echo "获取 OpenSSH 最新版本..."
OPENSSH_VERSION=$(curl -s $OPENSSH_MIRROR | grep -oP 'openssh-\d+\.\d+p\d+\.tar\.gz' | sort -V | tail -1)
echo "最新 OpenSSH 版本: $OPENSSH_VERSION"

wget -c "${OPENSSH_MIRROR}${OPENSSH_VERSION}"
tar zxf $OPENSSH_VERSION
OPENSSH_SRC_DIR=$(tar -tf $OPENSSH_VERSION | head -1 | cut -d/ -f1)

OPENSSL_PREFIX="/usr/local/openssl"
export LD_LIBRARY_PATH="$OPENSSL_PREFIX/lib:$LD_LIBRARY_PATH"
export PKG_CONFIG_PATH="$OPENSSL_PREFIX/lib/pkgconfig"
export CFLAGS="-I$OPENSSL_PREFIX/include"
export LDFLAGS="-L$OPENSSL_PREFIX/lib"

cd "$OPENSSH_SRC_DIR"
echo "编译安装 OpenSSH..."
./configure --prefix=/usr \
  --sysconfdir=/etc/ssh \
  --with-ssl-dir=$OPENSSL_PREFIX \
  --with-zlib \
  --with-md5-passwords \
  --with-pam \
  --without-openssl-header-check \
  --with-ldflags="-L$OPENSSL_PREFIX/lib" \
  --with-cflags="-I$OPENSSL_PREFIX/include"

make -j$(nproc)
make install
cd ..

# 步骤 6: 配置 SSH
echo "修改 SSH 配置，设置端口34022并允许root远程登录..."
sed -i 's/^#\?Port .*/Port 34022/' /etc/ssh/sshd_config

if grep -q "^PermitRootLogin" /etc/ssh/sshd_config; then
    sed -i 's/^PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config
else
    echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
fi

# 步骤 7: 重启 SSH 服务
echo "重启 SSH 服务..."
systemctl restart ssh || service ssh restart

echo "全部操作完成。请确保 34022 端口防火墙已放通，并测试新端口可用。"
